NAVAL  P08T6RADUATE  SCHOOL 

Monterey,  California 


SURVIVABILITY  DESIGN  GUIDELINES 

FOB  FLY-BY-WIRE  FLIGHT  CONTROL  SYSTEMS  DEVELOPMENT 

by 

Daniel  Timothy  Hogan 

December  1983 

Thesis  Advisor; 

R.  E.  Ball 

Approved  for  public  release;  distribution  unlimited 


DT1C 

Hk  FEB  2  4  1984 


v* 

•* 


8  4  02  24  025 


or  TwtI  ran*  °«n  enitfd) 

l”~  REPORT  DOCUMENTATION  PACE 


2.  00 VT  ACCESSION  NO. 

AD-Jlil 


READ  INSTRUCTIONS 
BEFORE  COMPLETING  FORM 
i.  recipient's  catalog  number 


l«-  title  cam  Su*Mi<«) 


Survivability  Design  Guidelines  for 
Fly-By-Wire  Flight  Control  Systems  Development 

i  auTmoac*;  ' 

Daniel  Timothy  Hogan 


912  2 


S.  TYNE  OF  REPORT  A  PERIOD  COVERED 

Master's  Thesis 
December  1983 

S.  PERFORMING  QRG.  REPORT  NUMBER 
S.  CONTRACT  OR  GRANT  NUMBER*"*; 


»■  PERFORMING  ORGANIZATION  name  ano  aooress 

Naval  Postgraduate  School 
Monterey,  California  93943 


10.  PROGRAM  ELEMENT.  PROJECT,  TASK 
AREA  A  WORK  UNIT  NUMBERS 


•  1.  CONTROLLING  OFFICE  NAME  ANO  AOORESS  — 

Naval  Postgraduate  School 
Monterey,  California  93943 

<«■  MONI+O&ING  AGENCY  NAME  A  AOORESSCIC  dllUmtt  tram  Ctmtrolllnt  OfNcpJ 


12.  REPORT  DATE 

December  1983 
is.  NUMBER  OF  pages 

66 

is.  SECURITY  CLASS.  (Ol  [ hit  rmpon) 


IS#.  DECLASSIFICATION'  downgrading 
schedule 


I  IB.  DISTRIBUTION  STATEMENT  (•!  Mr  jStRArQ 


Approved  for  public  release;  distribution  unlimited. 


I  IT.  OISTNISUTION  STATEMENT  (•!  (As  aAafract  mtm4  lit  BUcA  20,  II  Ulllniu  Ami  R«pwf;  ' 


|IB.  SU PPL  EMI 


IB.  KEY  WORDS  (Cmtlmtt  «n  nwh  (Ml  II  UHllHTf  n«  IRaMiy  A y  Mac*  ttumhmt) 

Survivability  DFBW 

Design  Guidelines  Flight  Control  Systems 

Fly-By-Wire 

FBW 

Digital  Fly-By-Wire _ 

20.  ABSTRACT  (CmmUmm  m  wpr  II MMIMR  AM  IRmUr  A>  Mw>  iwAarJ 

y  Survivability  of  military  combat  aircraft  has  received  increased  emphasis  — > 
by  the  U.S.  Armed  Services -*in  recent  years.  The  primary  objective  of  the 
U.S.  Military  Survivability  Policy  is  to  ensure  that  effective  survivability 
enhancement  features  are  incorporated  in  current  and  all  future  U.S.  combat 
aircraft.  Technology  advances  in  Fly-By-Wire  Flight  Control  Systems  have 
significantly  enhanced  the  performance  capabilities  of  modern  fighter/attack 
aircraft.  In  consonance  with  the  military  services  survivability  policy,  - 


DO  i  jan*tj  1473  tanoN  of  i  nov  bb  is  obsolete  i 

S/M  0102*  LF>  014- A601 


security  classification  of  this  page  rsKm  Dwa  (unw 


SECURITY  CLASSIFICATION  OF  This  FAOC  r*Ma  Dm*  fawn 


_^a  series/of  survivability  design  guidelines  for  Fly-By-Wire  Flight  Control 
Systems ^have  been  developed,,. and"'  are  herein^presented.  A  recommendation 
for  future  survivability  enhancement  through  the  use  of  digital  flight 
control  technology,  in  a  manner  similar  to  artificial  intelligence,  is 
presented.  ^ 


Access 


si  cr.  Fir  / 

■*■‘1 . 

T.'.K  ^ 


■  c  1  o 

.  l  :t>ti  "Ji 


G) 


L'l-itributl  tnf 
Availability  Ccces 
[Avail  ar.tf/or 
Special 


Pi9t 


til 


$  N  0 1 03-  LF- 014- *401 


SECURITY  CLASSIFICATION  of  this  FAMflHtaR 


on 


Approved  for  public  release,  distribution  ur.liairrd 

Survivability  Design  Guidelines 
for  Fly-By-Hire  Flight  Control  Systeas  Development 


Daniel  Timothy  Hogan 

Lieutenant  Commander,  United  Stales  Navy 
B.S.,  0.  S.  Naval  Academy,  1973 
M.S.S.N,  University  of  Southern  California,  1979 

Submitted  in  partial  fulfillment  of  the 
requirements  for  the  degree  of 

HASTES  OF  SCIENCE  IN  AERONAUTICAL  ENGINEERING 

from  the 

NAVAL  POSTGRADUATE  SCHOOL 
December  1983 


Author: 


Approved  by: _ 


W 


lesis  Adviser 


Chairman,  Department  of  Aeronautics 


Dean  of  Science  and  Engineering 


ABSTRACT 


Survivability  of  military  coabat  aircraft  has  received 
increased  emphasis  by  the  0.  S.  Armed  Services  in  recent 
years.  The  primary  abjective  of  the  U.  S.  Military 
Survivability  Policy  is  to  ensure  that  effective 
survivability  enhancement  features  are  incorporated  ir. 
current  and  all  future  0.  S.  combat  aircraft.  Technology 
advances  in  Fly-By-Wire  Flight  Control  Systems  have 
significantly  enhanced  the  performance  capabilities  of 
modern  fighter/attack  aircraft.  In  consonance  with  the 
military  services  survivability  policy,  a  series  of 
survivability  design  guidelines  for  Fly-3y-wirs  Flight 
Control  Systems  have  been  developed,  and  are  herein 
presented.  A  recommendation  for  future  survivability 
enhancement  through  the  use  of  digital  flight  control 
technology,  in  a  lanner  similar  to  artificial  intelligence, 
is  presented. 
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I.  INTRODUCTION 


A.  COMBAT  SURVIVABILITY.  .  ..A  TECHNOLOGY  ISSUE 

In  the  skies  today  and  on  the  drawing  hoards  for 
tomorrow  are  military  aircraft  that  are  technological 
marvels.  The  F-15,  and  F/A-18  are  superior  fiah-sr  ard 
attack  aircraft  that  employ  the  very  latest  in 
state-of-the-art  technologies  in  computers,  flight  control 
systems,  engines,  and  structural  materials.  These  machines 
have  been  optimized  to  levels  heretofore  unobtainable. 
Performance  has  been  built-in  to  these  aircraft.  And  so  has 

something  else, . Survivability.  These  aircraft  were 

designed  tc  perform  their  assigned  combat  missions  in  the 
face  of  modern  arsenals  and  to  return  to  their  bases  to  fly 
again.  However,  the  question  must  be  asked,  have  these 
aircraft  designs  realized  the  utmost  in  survivability 
benefits  that  modern  digital  systems  technologies  have  to 
offer? 

Because  history  has  shown  that  the  importance  of 
survivability  has  sometimes  been  forgotten  or  neglected  in 
the  design  and  development  of  military  aircraft  in 
peacetime,  it  is  incumbent  upon  the  aircaft  designer,  the 
military  program  manager,  and  the  combat  aviator  to  ensure 


•that  today's  technological  advances,  particularly  ir  rh* 
application  cf  computer  augmented  flight  oor.trcl  systeas, 
continue  to  provide  the  survivability  enhancement  features 
that  will  keep  the  cutting  edge  of  our  nation's  defense 
keen . 

B.  U.  S.  MILITARY  SU  RV  IV  AEILITY  POLICY 

Survivability  has  been  increasingly  emphasized  by  the 
0.  S.  Armed  Services  in  recent  years.  The  Department  of 
Defense  and  the  Military  Service  Brancnes  have  established 
firm  survivability  policies  regarding  arms  acquisitions. 
The  primary  objective  of  the  U.  S.  Military  S arvr7abili‘ y 
Policy  is  tc  ensure  that  effective  surviva oilit y  er.hanceaet 
features  are  incorporated  ir.  current  and  all  future  U.  s. 
weapons  systems. 

A  triservice  organization,  the  Joint  Technical 
Coordinating  Group  on  Aircraft  Survivability  (JTC3/AS)  , 
created  in  1971,  has  brought  together  toe  Dest  expertise  i 
each  of  the  service  branches  to  plan  and  execute  a 
comprehensive  program  to  increase  the  survivability  of 
current  and  future  aircraft  assets.  rfithin  the  JTCG/AS 
charter  are  tasks  to  develop  design  criteria  and  improved 
technology  to  increase  the  survivability  of  future  combat 
aircraft  and  weapons  systems. 


C.  SURVIVABILITY  REQUI REMENTS/GUIDELINES/ST ANDARDS 

Survivability  requirements  for  airborne  weapon  systems 
have  been  specified  in  different  ways  by  each  branch  of  the 
Armed  Services.  The  Navy  established  AERONAUTICAL 
REQUIREMENT  <AR)-107,  "Navy  Aircraft 

Survivability/Vulnerability  (Nuclear/Nonnuclear)  ir.  1974. 
MIL-STD- 2072  (AS)  ,  ''Military  Standard:  Survivatili- y , 

Aircraft;  Establishment  and  Conduct  of  Programs  for," 
superseded  AR-107  in  1977.  In  1981,  The  Department  of 
Defense  issued  MIL-STD-2069,  "Requirements  for  Aircraft 
Nonnuclear  survivability  Programs."  Each  document  was 
prepared  in  recognition  of  the  need  for  a  standardized 
systems  approach  to  improving  the  survivability  of  U.S. 
military  aircraft. 

DOD  MIL-STD-206  9  provided  guidelines  and  requirements 
for  establishing  and  conducting  aircraft  survivability 
programs.  Applicability  cf  the  principles  contained  therein 
apply  to  all  major  weapons  system  acquisition  programs  and 
is  the  standard  invoked  in  contractual  agreements  regarding 
aircraft  armaments. 

Various  forms  of  handbooks  have  been  prepared  to  provide 
military  planners  and  industrial  designers  with  the 
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information  and  guidance  needed  in  incorporating 
survivability  featuras  into  new  and  existing  systems.  The 
Air  Force  Systems  Command  has  published  a  design  handbook 
series,  DH-1  through  DH-3  (with  supplements)  for  use  with 
Air  Force  programs.  The  Army  has  publisasd  a  "Survivability 
Design  Guide  for  Army  Aircraft,"  USAAMRDL  TR-7  1-4  1.  The 
Navy  established  MIL-HDBK-268  (AS),  "Survivability 
Enhancement,  Aircraft  Conventional  Weapons  Threats,  Design 
and  Evaluation  Guidelines,"  in  August  1982  for  use  in  the 
acquisition  process  of  Naval  aircraft  systems.  Jointly,  the 
three  services  work  within  the  guidelines  established  by  the 
JTCG/AS  and  published  in  several  volumes  as 
DGD-MIL-HDBK-336,  "Survivability,  Aircraft,  Nonnuclear, 
(Various)  . " 

D.  WHY  BE  CONCERNED  WITH  AIRCRAFT  FLIGHT  CONTROL  SYSTEMS? 

The  essential  question  of  flight  control  survivability 
was  derived  by  the  author  from  a  statement  eminating  from  an 
analysis  of  Southeast  Asia  combat  files  maintained  by  the 
Combat  Data  and  Information  Center  (CDIC) .  The  statement 
attributed  approximately  25%  of  all  aircraft  lost  in 
Southeast  Asia  to  the  functional  loss  of  the  aircraft's 
flight  control  system  as  a  result  of  combat  induced  damage. 
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This  percentage  figure  equated  to  nearly  500  aircraft. 
Preliminary  investigation  revealed  that  the  flighr  control 
system  of  most  conventional  combat  aircraft  contributed 
approximately  5*5  to  the  aircraft's  total  presented  area. 
The  disproportionality  of  the  two  figures  generate!  & 
concern  that  culminated  in  the  development  of  the  guidelines 
contained  herein. 

E.  PURPOSE 

The  purpose  of  this  treatise  is  to  present  ir.  a  single 
document  guidelines  for  the  development  of  aircraft  flight 
control  systems  (FCS )  with  specific  emphasis  on  increasing 
the  combat  survivability  of  aircraft  equipped  with 
Fly-By-Hire  (FEW)  flight  control  systems. 

F.  SCOPE 

The  scope  of  this  effort  was  limited  to  nonnuclear 
weapons  effects  considerations.  The  Ply-by-Wire  flight 
control  systems  development  guidelines  presented  within  were 
developed  in  connection  with  the  damage  causing  mechanisms 
associated  with  conventional  weapons  systems,  self  generated 
electromagnetic  interference  (EH I)  phenomena,  and  normal 
inflight  environmental/meteorological  conditions  to  be 
expected  in  the  combat  aircraft's  operating  environment. 
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II.  FOND AMENT\L  SURVI VABILITY  CONCEPTS 

A.  WHAT  IS  AISCPAPT  COMBAT  SURVIVABILITY? 

Aircraft  combat  survivability  has  bast  defined  as  ”th a 
capability  of  an  aircraft  (weapon  system)  to  avoid  ar.d/or 
withstand  a  man-made  hostile  environs  an t”  [Ref.  1]. 
Paramount  in  this  definition  is  the  ability  ”-c  avoid  ar.d/or 
withstand.”  The  inability  ”to  avoid,”  the  hostile 
environment  is  referred  to  as  susceptibility.  The  inability 
"to  withstand,”  the  hostile  environment  is  referred  to  as 
vulnerability. 

Susceptibility,  often  measured  as  the  probability  cf 
being  hit,  Ph,  can  be  divided  into  three  general  categories: 

(1)  Defensive  weapon  system  threat  activity 

(2)  Detection,  identification,  and  tracking  by 
defensive  weapon  systems 

(3)  Engagement  by  defensive  weapon  systems  (i.e., 
missile  launch  or  gun  firing;  warhead  guidance; 
warhead  impact  or  detonation) 

The  susceptibility  of  an  aircraft  can  be  influenced  by 
the  aircraft's  signatures,  the  tactics  and  supporting  forces 
employed,  and  the  integral  survivability  enhancement 
equipment  carried  on  or  within  the  aircraft.  Small  size. 


increased  maneuverability ,  low  visual/radar /aurai/ir.  f rarsd 
signatures,  terrain  ma  sking/te  rrain  following  tactics, 
active/passive  electronic  countermeasures,  dec cys,  and 
antiradiation  missiles  are  but  a  limited  selection  of  -.he 
means  to  reduce  an  aircraft's  susceptibility. 

Vulnerability,  often  measured  as  the  probability  cf 
being  killed  if  hit,  Pk/h,  is  a  direct  function  and  measure 
of  the  aircaft's  design,  and  any  survivability  enhancement 
feature  that  reduces  the  amount  and  effect  of  damage  induced 
by  an  enemy's  weapon  systems  damage  mechanisms. 
Vulnerability  is  influenced  by  the  ability  of  a  system  to 
continue  to  operate  after  being  hit  and  by  design  features 
and  equipment  that  prevent  or  suppress  damage.  A  flight 
control  system  that  continues  to  function  after  sustaining  a 
hit  by  a  damage  mechanism  on  one  cf  its  components  is  an 
example  of  reduced  aircraft  vulnerability. 

B.  SURVIVABILITY  ENHANCEMENT  CONCEPTS 

Survivability  enhancements  have  been  generally 
categorized  as  any  feature  of  an  aircraft,  any  equipment 
carried,  any  tactic  employed,  or  any  combination  thereof 
that  reduces  the  susceptibility  and/or  the  vulnerability  of 
an  aircraft.  Survivability  enhancements  can  be  separately 
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concentrated  into  either  susceptibility  reduction  features 
or  vulnerability  reduction  features.  Those  specific 
susceptibility  and  vulnerability  reduction  features  can  be 
summarized  generically  into  conceptual  elements.  The  first 
of  the  two  categories  relating  the  major  survivability 
enhancement  concepts  is  listed  in  Table  I. 

TABLE  I 

Survivability  Enhancement  Concepts  -  Susceptibility 

Redu ct ion 

(1)  Signature  Reduction 

(2)  Warning  Receivers 

(3)  Electronic  Countermeasures  Devices 

(4)  Expendables 

(5)  Tactics 

(6)  Threat  Suppression 

As  presented  in  Table  I,  a  reduction  in  an  aircraft's 
susceptibility  can  be  brought  about  by  decreasing  its 
detectability  through  signature  reduction.  Reducing  an 
aircraft's  ability  to  be  detected  and  tracts ed  by  an  enemy 
can  best  be  accomplished  in  the  design  process. 
Incorporation  of  quieter,  smokeless  engines,  utilizing  radar 
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absorbent  materials,  eliminating  sharp  edges  (corner 
reflectors),  and  prescribing  low  IS  reflective  paint  schemes 
are  examples  of  this  technique.  Alerting  the  crew  to 
impending  missile  or  gun  activity  can  be  achieved  through 
the  use  of  appropriately  selected  warning  receivers. 
Incorporating  electronic  counter  measures  devices,  such  as 
noise  jammers  and  deception  repeaters,  can  degrade  or 
prevent  an  enemy's  defensive  systems  ability  to  achieve  a 
suitable  weapons  firing  solution.  Expendables,  in  the  form 
of  chaff,  infrared  flares,  and  off-board  decoy  devices,  can 
confuse  and  degrade  an  enemy's  weapon  systems  by  masking  an 
aircraft's  true  identity  or  location.  Minimization  of 
exposure  to  an  enemy's  defensive  network  can  be  achieved 
through  a  suitable  selection  of  tactics  alternatives. 
Examples  of  this  technique  can  be  found  in  operational  plans 
that  take  advantage  of  terrain  following/terrain  masking 
flight  profiles  and  that  utilize  stand-off  or 
launch-and-leave  weapons.  The  impact  of  crew  skiil  and 
experience  and  the  increased  performance  capabilities  of  the 
modern  fighter/attack  aircraft,  brought  about,  in  part,  by 
the  incorporation  of  FBH  flight  control  systems  technology, 
can  have  a  major  impact  on  tactics  selection.  Threat 
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suppression,  the  ability  to  actively  deny  the  enemy  an 
unhindered  opportunity  to  fire  his  weapons,  car.  be  achieved 
by  attacking  his  weapons  emplacements  with  such  means  as 
anti-radiation  missiles  and  coordinated  supporting  fire  from 
ancillary  units. 

The  six  concepts  described  above  comprise  susceptibility 
reduction,  the  avoidance  portion  of  the  survivability  dual. 
Completing  the  dual  are  six  vulnerability  reduction  j 

concepts.  These  six  complementary  concepts  are  presented  in 
Table  II.  j 

TABLE  II 

Survivability  Enhancement  Concepts  -  Vulnerability  Reduction 


(1) 

Component 

Location 

(2) 

Component 

Shie lding 

(3) 

Component 

Redundancy 

(«) 

Compone  nt 

Elim ination 

(5) 

Passive  Damage  Suppression 

(6) 

Active  Damage  Suppression 

Vulnerability  reduction  can  be  best  achieved  ir.  the 
design  phases  of  an  aircraft's  development.  Judicious 
selection  of  the  location  of  critical  components  to  minimize 
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the  possibility  of  damage  and  shielding  those  critical 
components  to  prevent  damage  mechanisms  from  striking  the 
components,  rendering  them  unser vicable,  are  techniques  most 
suited  to  be  achieved  during  the  early  design  phases. 
Incorporation  of  more  than  one  component  to  perform  a 
critical  function  (component  redundancy)  can  have  a  major 
impact  on  the  vulnerability  of  an  aircraft  or  aircraft 
system.  Additional  reductions  may  be  achieved  through  the 
elimination  of  components  entirely  (component  elimination). 
Passive  and  active  damage  suppression  reduces  aircraft 
vulnerability  either  by  controlling  the  effects  of  damage 
mechanisms  or  by  reducing  or  preventing  the  subsequent 
spread  of  further  damage  causing  effects. 

Suitable  attainment  of  an  appropriate  level  of  aircraft 
survivability  can  be  achieved  through  the  incorporation  of 
elements  from  each  of  the  survivability  enhancement  concepts 
described.  However,  it  must  be  noted  that  no*-,  all 
survivability  enhancement  concepts  are  necessary  or 
appropriate  for  any  particular  aircraft  type  on  any 
particular  mission.  Paradoxically,  a  reduction  in 
vulnerability  may  lead  to  a  greater  degree  of 
susceptibility,  such  as  the  case  faced  by  the  designer  when 
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adding  large  amounts  of  armor  plate  to  an  aircraft,  thereby 
increasing  the  ability  to  tolerate  a  hit,  but  making  the 
aircraft  more  susceptible  to  being  hit  by  reducing  its 
speed.  Consequently,  the  early  identification  and 
successful  incorporation  of  those  survivability  enhancement 
features  that  most  significantly  increase  the  survivability 
of  the  aircraft's  flight  control  system  and  increase  the 
mission  effectiveness  of  the  combat  aircraft  as  a  weapons 
system  is  to  be  regarded  as  a  goal  of  the  survivability 
discipline. 
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III.  FLIGHT  CONTROL  SXSJEMS 
A.  FLIGHT  CONTROL  BASICS 

Flight  path  control  of  an  aircraft  is  accomplished  by 
means  of  a  complex  series  of  =1 ectrical,  hydraulic,  and 
mechanical  devices  collectively  titled  the  flight  control 
system  (PCS).  These  basic  elements,  when  transformed  into 
sensors,  signal  paths,  actuators,  and  surface  panels, 
provide  the  means  by  which  the  pilot  commands  an  aircraft 
in-flight  about  the  three  axes  of  motion. 

Conventional  military  aircraft  utilize  three  primary 
control  surfaces  to  control  the  three  dimensional  motion  of 
the  aircraft:  the  elevators,  the  rudder  and  the  ailerons.  A 
right-hand  orthogonal  axis  system  and  the  motions  produced 
by  the  associated  control  surfaces  are  illustrated  in  Figure 
3.  1. 

Deviations  froi  the  basic  control  surfaces  are  functions 
of  the  geometric  shape  of  the  aircraft.  In  soma  aircraft 
configurations,  the  elevators  are  replaced  by  a  solid 
horizontal  tail,  designated  either  a  stabilator  or 
stabilizer  by  the  lanuf acturer,  which  moves  as  a  single  unit 
to  provide  pitch  control.  In  some  aircraft,  the  tail 
surfaces  can  be  controlled  either  symmetrically  cr 
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Figure  3.1.  Refarence  Axes/Control  Surface  Deflections 

assynsetrically  to  provide  pitch  and  roll  control.  This 
type  of  tail  surface  is  known  as  a  differential  stabilator. 
Tailless  aircraft  employ  elevons  in  place  of  ailerons  and 
elevators  to  provide  pitch  and  roll  control.  Plaperons 
replace  ailerons  in  still  other  designs. 

Additional  surfaces,  such  as  speedbrakes,  spoilers, 
leading  and  trailing  edge  flaps,  and  leading  edge  slats,  are 


classified  as  secondary  of  auxiliary  control  surfaces. 
These  devices  provide  an  aircraft  a  means  of  speed  and 
direct  lift  control,  and  can  be  used  as  back-up  control 
surfaces.  Despite  the  noaecclature  and  physical 
differences,  the  primary  function  of  a  particular  control 
system  configuration  remains  to  guide  the  aircraft  in  three 
dimensional  flight. 

B.  MECHANICAL  FLI3HT  CONTROL  SYSTEM  BASICS 
Conventional  flight  control  surface  movements  are 

commanded  by  the  pilot  through  the  control  column  and 
control  pedals.  Movement  of  the  elevator  and  ailerons  is 
commanded  by  means  of  a  stick  or  wheel  controller,  and 
movement  of  the  rudder  is  prescribed  by  a  pair  of  rudder 
pedals.  The  basic  mechanization  scheme  is  illustrated  in 
Figure  3.2.  The  control  column  and  rudder  pedals  are 
mechanically  linked  to  the  control  surfaces  by  cables, 
pushrods,  and  bellcranks  as  illustrated  in  Figure  3.3  for  a 
longitudinal  control  system. 

C.  POWER-ASSISTED  CONTROL  SYSTEM  BASICS 

Most  high  speed  military  combat  aircraft  require  some 
fora  of  powered  flight  control  system  to  give  the  pilot 
adequate  ccntrcl  of  the  aircraft  throughout  the  flight 
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MECHANICAL  POWER  AND  CONTROL: 


HINGE 

ENGINE  MOMENT 


Mechanical 


Figure  3.2.  Hechanical  Flight  Control  Mechanization 


Figure  3.3.  Bechanical  Longitudinal  control  Systee 


envelope.  Conventional  power- assisted  control  system 
designs  usually  derive  the  additional  power  by  means  of 
hydro-mechanical  devices.  The  fundamental  configuration  is 
depicted  in  Figure  3.4.  The  hydraulic  pump,  selector  valve, 
servoactuators,  and  associated  plumbing,  while  adding  weight 
and  complexity  to  the  control  system,  provide  the  additional 
power  required.  Artificial  feel  devices  are  generally 
incorporated  in  the  mechanical  linkage  to  provide  feedback 
to  the  pilot.  Figure  3.5  illustrates  the  basic 
mechanization  of  a  conventional  hydraulic  powered 
longitudinal  control  system. 

D.  FLY-BY-HIHE  (FBH)  CONTBOL  SYSTEM  BASICS 

Many  modern,  high  technology  combat  aircraft  »mplc? 
fly-by-wire  flight  control  systems.  In  the  basic 
configuration,  illustrated  in  Figure  3.6,  the  pilot  is 
linked  to  the  control  actuators  by  electrical  wires. 

The  electrical  wiring  provides  the  control  signal  paths  that 
transmit  the  pilot's  commands  to  the  servoactuators. 
Sophisticated  artificial  feel  devices  provide  feedback  tc 
the  pilot.  The  basic  FBH  control  system  configuration  is 
electrically  noisy,  and  the  aircraft  is  prone  to  pilot 
induced  oscillations.  To  aid  in  the  controllability  of  the 


26 


CONVENTIONAL  HYDRAULICS:  A  centralized  system  with 

engine  mounted  oumps  to 
supply  hydraulic  fluid 
through  metal  lines  at 
3000  psi. 
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Mechanical 
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Figure  3.4.  Hydraulic  Power  Systea  Mechanization 


aircraft,  a  series  of  electronic  filters  is  often  inserted 
in  the  system  between  the  pilot  and  the  electro-mechanical 
selector  device  to  reduce  noise  transients. 


E.  COMPUTER  AUGMENTED  FB  W  CONTROL  SYSTEM  BASICS 

High  speed  computers,  in-line  with  tha  basic  FBW  flight 


control  systea,  may  be  used  to  either  augaent  or  provide  the 
controllability  of  the  aircraft.  Computer  monitoring  of  the 


Control  stick 


Figure  3.5.  Hydraulic  Powered  Longitudinal  Control  System 

flight  environment  through  the  addition  of  motion  and  rate 
sensors  coupled  to  the  computer  relieves  the  pilot  of  the 
responsibility  to  continuously  monitor  his  flight  path. 

One  of  the  most  sophisticated  applications  of  a  digital 
computer  augmented  FBW  flight  control  system  in  a  military 
combat  aircraft  is  the  McDonnell-Douglas  F/A-18  "Hornet." 
This  aircraft  employs  high  speed  digital  computers  in-line 
with  a  state-of-the-art  FBW  system  to  provide  the  very 
latest  in  high  performance  aircraft  flight  control  systems 
technology. 


FLY-BY-WIRE:  The  conventional  mechanical  linkage 
between  the  pilot's  control  input 
and  mechanical  controller  is  replaced 
by  an  electrical  signal  used  to 
activate  the  control  surface  actuator. 
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Figure  3.6.  Ply-by-lire  Control  Systee  Bechanization 


The  functional  design  cf  the  F/A-19  Digital  Fly-by-Hire 
(DFBH)  flight  control  system  is  illustrated  in  Figure  3.7. 
The  basic  mechanical  and  electrical  FCS  subsystems  are 
diagrammed  in  Figure  3.8.  The  basic  hydraulic  FCS 
subsystems  are  depicted  in  Figure  3.9.  Note  the  mechanical 
back-up  components  for  controlling  the  pitch  and  roll  motion 
of  the  aircraft. 


29 
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Pigara  3.9.  F/l- 18  PCS  Hydraulic  Subsystea  Diagraa 


IV.  FCS  FAILURE/ DAM AGE  MODES  IDENTIFICATION 

A.  SYSTEM  VULNERABILITY  CONTRIBUTIONS 

Each  individual  coiponent  of  an  aircraft  has  a  level  of 
vulnerability  that  contributes  to  the  overall  vulnerability 
of  the  aircraft.  Certain  components  contribute  more  than 
others,  and  those  components  which,  when  damaged  or 
destroyed,  lead  to  an  aircraft  loss  are  the  ones  of  interest 
hare.  These  components  are  known  as  critical  components. 
The  systeaaatic  identification  of  the  critical  components 
and  the  quantification  of  the  vulnerability  of  individual 
components  is  a  part  of  the  overall  aircraft  vulnerability 
assessment.  As  the  vulnerability  contribution  of  each 
component,  subsystem  and  system  is  assessed,  various  methods 
may  be  implemented  to  reduce  the  overall  aircraft 
vulnerability.  The  vulnerability  reduction  technique (s) 
chosen  for  implementation  in  the  FCS  must  allow  the  FCS 
design  to  remain  within  the  constraints  of  cost,  weight, 
performance,  accessibility,  and  maintainability,  et  cetera 
imposed  by  contractual  agreement. 
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B.  IDENTIFICATION  OP  CRITICAL  CONPONENrS 

One  purpose  of  a  vulnerability  assessment  is  the 
identification  of  those  components  whose  damage  or  loss 
could  lead  to  an  aircraft  kill.  A  general  procedure  has 
been  formulated  for  determining  the  critical  components, 
their  possible  damage  or  failure  modes,  and  the  effects  of 
the  damage  or  failure  on  the  continued  operation  of  the 
aircraft  [Bef.  1]. 

Fundamentally,  the  procedure  is  comprised  of  three 
steps: 

(1)  selection  of  an  aircraft  kill  level. 

(2)  formulation  of  a  complete  technical  and  functional 
description  of  the  aircraft. 

(3)  the  identification  and  delineation  of  the  critical 
components. 

1.  Aircraft  Kiil.  Levels 

Combat  damaged  aircraft  and  aircraft  systems  suffer 
performance  degradations  in  varying  degrees.  The  level  to 
which  the  performance  degradation  progresses  can,  in 
general,  be  categorized  as  an  attrition  kill,  a  mission 
abort  kill,  or  a  forced  landing  kill. 
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An  attrition  kill  is  defined  as  that  isasurs  of 
aircraft  damage  that  results  in  the  loss  of  the  aircraft 
from  the  inventory.  Repairability  and  economy  of  repair  are 
factors  which  aay  contribute  to  to  an  attrition  kill  without 
the  physical  loss  of  the  aircraft.  However,  it  is  the 
elapsed  tine  from  daaage  onset  to  eventual  aircraft  less 
which  provides  the  scale  with  which  to  differentiate  between 
attrition  kill  levels.  Several  attrition  kill  levels  have 
been  defined;  such  as  "KK",  ,,KM ,  "A*1,  and  " B",  impressed  on 
a  tine  tc  aircraft  loss  scale.  Detailed  kill  level 

descriptions  are  contained  within  DOD 

MIL -STD- 3 36- 1  (He*-  2]. 

k  aission  abort  kill  is  defined  as  that  measure  of 
aircraft  daaage  which  results  in  an  aircraft  failing  to 
conpleta  its  assigned  aission,  but  that  dees  not  result  in  a 
loss  of  the  aircraft  froa  the  inventory. 

k  forced  landing  kill,  specifically  applicable  to 
helicopters,  VTOL,  and  certain  V/STOL  aircraft,  is  defined 
as  that  aeasure  of  aircraft  daaage  that  causes  the  pilot  to 
land  his  aircraft  short  of  the  intended  destination,  and  the 
failure  to  do  so  would  result  in  the  destruction  of  the 


aircraft 


2.  Aircraft  Technical  and  Functional  fiiscrijgricn 

At  each  successive  stage  of  the  aircraft  design 
process,  the  technical  and  functional  descriptions  of 
aircraft  systems  and  components  become  better  defined. 
These  descriptions,  with  individual  component  ar.d  systems 
dimensions,  materials,  operations  and  functions  interfaces, 
scale  and  perspective  drawings,  and  aircraft  location 
profiles,  comprise  the  detailed  technical  base  for  use  in 
the  vulnerability  assessment.  Gathering  and  continuously 
updating  this  data  base,  as  it  is  formula-red,  should  be 
given  a  very  high  priority. 

3.  Critical  C2IE2£SlU  Identification  Procedure 

A  sequenced  procedure  has  been  formulated  to 
identify  the  critical  components  [Ref.  1].  The  first  step 
in  this  analysis  procedure  for  the  FCS  is  to  identify  the 
flight  essential  functions  that  the  FCS  must  perform  in 
order  to  continue  to  accomplish  the  aircraft’s  mission.  The 
second  step  is  to  identify  those  FCS  subsystems  and 
components  that  provide  or  perform  the  essential  functions. 
The  third  step  is  to  conduct  a  failure  mode  and  effects 
analysis  (FHEA)  and/or  a  fault  tree  analysis  (FTA|  to 
identify  the  relationship  between  the  individual  component 
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or  subsystem  failure  and  the  essential  function  (s)  it 
provides  or  performs.  The  fourth  step,  the  damage  modes  and 
effects  analysis  (DME  A)  ,  consists  of  relating  the  component 
or  subsystem  failure  modes  to  combat  damage  causes.  The 
final  step  in  the  process,  the  presentation  of  the  results, 
is  often  expressed  in  a  logical  sequence  Known  as  a  till 
expression,  or  represented  graphically  as  a  kill  tree. 

4.  Procedural  Example  -  Generic  DFBH  fCS 

To  illustrate  this  dynamic  process,  the  flight 
control  system  of  a  generic  fighter/af tack  aircraft  will  b? 
utilized.  The  time  scale  of  a  "B"  level  attrition  kill  will 
be  imposed  for  illustrative  purposes. 

A  schematic  representation  of  the  example  dfbh  PCS 
layout  is  shown  in  Figure  4. 1.  specific  technical  and 
functional  interfaces  are  depicted  in  Figure  4.2.  The  FCS 
utilizes  dual,  high  speed  digital  computers,  quadruple 
transmission  signal  paths,  two  independent  hydraulic 
systems,  and  dual,  tandem  hydraulic  actuators  at  all  control 
surfaces.  No  back-up  mechanical  control  linkage  is 
provided. 

Flight  essential  functions  are  those  that  are 
required  tc  sustain  controlled  flight  with  qualities  not 
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Figure  4.1.  Generic  DFBf  FCS  Illustration 

lass  than  level  3  as  defined  by  MIL-F-8735C  [Ref.  3].  Each 
mission  phase  constitutes  an  evaluation  point  in  the 
process.  Mission  phases  for  a  typical  multipurpose 
f ighter/attack  aircraft  include  takeoff,  climb,  outbound 
cruise,  descent,  target  ingress,  ordnance  delivery,  target 
egress,  climb,  inbound  cruise,  descent,  and  landincr,  as 
shown  in  Figure  4.3.  Figure  4.4  delineates  those  flight 
essential  functions  in  a  typical  format  for  the  example 
fighter/attack  aircraft. 
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► 


Figure  4.2.  Technical/Functional  Interfaces  -  DFB»  PCS 


To  fly  and  conduct  the  aircraft’s  mission  requires 
the  continued  operation  cf  those  supporting  systems  or 
subsystems  that  provide  or  perform  the  essential  FCS 
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Figure  4.3.  Pighter /Attack  Mission  Profile  Phases 


function.  The  level  of  severity  and  time  criticality  of 
loss  of  these  supporting  systems  or  subsystems  must  be 
evaluated  during  this  process  step.  Figure  4.5  depicts  a 
sample  tabulation  of  some  of  those  major  supporting  systems 
and  subsystems.  In  depth  and  detailed  analyses  of  each 
individual  supporting  element  must  be  carried  cut  as  each  of 
these  elements  becomes  sufficiently  defined  during  the 
design  process.  A  sample  tabulation  of  a  more  detailed 
analysis  is  presented  in  Figure  4.6. 
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Continuously  updating  the  technical  and  functional 
data  base  provides t  the  basis  and  means  for  further 
refinements  of  the  detailed  supporting  systems  analysis. 

The  third  phase  in  the  analysis  procedure  is  the 
failure  eode  and  effects  analysis  and/or  the  fault  tree 
analysis.  The  FHEA  is  a  "bot tons-up"  procedure  thar 
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Figure  4.5.  Basic  Systeas/Subsysteas  Supporting  The  Fes. 

identifies  all  possible  failure  nodes  of  a  component  or 
system,  documents  these  failure  modes,  and  determines  the 
effect  of  each  failure  mode  on  the  performance  of  the  system 
as  a  vhole.  The  details  of  the  FMEA  process,  and  specific 
procedures  can  be  found  in  HIL-STD-785  [Ref.  4]. 

Coaponent  failure  modes  generally  considered  in  an 
FHEA  include  failure  to  operate,  failure  to  terminate 
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Figure  4.6.  Detailed  Support  Systeas/Subsysteas  Analysis. 
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operation,  premature  operation,  aid  degraded  or 
out-of-tolerance  operation.  Unique  failure  modes  may  be 
singularly  inserted  in  this  stage  of  the  process.  An 
example  FHEA  summary  report  for  a  hydraulic  control  surface 
actuator  for  the  example  FCS  is  presented  in  Figure  4.7. 
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Figure  4.7.  Example  FHEA  Summary  Bepoct  -  Hyd.  Actuator 
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The  actuator  becomes  a  critical  component  for  »r. 
attrition  kill  if  it  jams  the  control  surface  into  a 
hard-over  condition,  but  it  is  not  a  critical  coaponent  if 
it  allows  the  control  surface  to  remain  unjammed. 

Another  analysis  procedure,  the  Fault  Tree  Analysis 
employs  a  "top-  down"  approach  [Ref.  5],  This  approach 
differs  from  the  FMEA  in  that  it  assumes  an  undesired  even 
and  systematically  determines  what  failure  or  sequence  of 
failures  could  cause  the  undesired  outcome.  A  segment  of  a 
FT  A  for  the  example  PCS  is  presented  in  Figure  4.8.  The 
symbology  utilized  in  the  FTA  analysis  is  common  to  logic 
systems  and,  as  such,  the  FTA  is  often  selected  for  its 
suitability  with  computational  systems. 

PCS  failure  modes  that  could  result  in  aircraft 
attrition  have  been  identified  for  the  example  PCS  and  are 
presented  in  Table  III. 

The  FMIA  and  FTA  related  failure  modes  and  effects 
but  did  not  distinguish  the  possible  cause  (s)  of  the 
failure.  The  Damage  Rode  and  Effects  Analysis  (DHEA) 
provides  this  essential  relationship.  In  the  DREA,  the 
coaponent  and  subsystem  failures  are  ralated  to  specific 
damage  causing  mechanisms  and  damage  processes,  included  i 
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Figure  4.8.  A  Scgaent  of  ia  FT  A  Foe  rb«  Szaaplo  FCS. 
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TABLE  III 


Example  PCS  Failure  doles  -  Attrition  Kill 

(1)  Loss  of  control  inputs 

(2)  Loss  of  motion  sensor  lata 

(3)  Loss  of  digital  computer  control 

(4)  Loss  of  electrical  power  to  computer  (s) 

(5)  Loss  of  control  signal  path 

(6)  Loss  of  hydraulic  system  power 

(7)  Loss  of  control  surface  actuator 

(8)  Loss  of  control  surface 

these  primary  damage  mechanisms  are  projectiles  and 
fragments,  blast  effects  from  high  explosive  warheads, 

4 

I 

incendiary  particles,  and  High  Energy  Lasers  (HEL)  .  The 
damage  these  agents  may  cause  includes  severed  electrical 

i 

*  power  distribution  lines,  sensor  signal  paths,  and  control 

signal  transmission  lines;  jammed  mechanical  linkages  and 
servoactuators ;  loss  of  hydraulic  pressure  and  hydraulic 
fluid  loss/leakage;  fire  (aggravated  by  petroleum  based 
hydraulic  fluid)  ;  HEL  burn-through  and  high  temperature 
heating  or  melting  of  PCS  components,  and  certain 
electromagnetic  incompatibilities  with  components,  devices, 
cables,  wiring,  and  connectors.  Secondary  damage  mechanisms 
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resulting  from  the  impact  of  the.  primary  agents  on  rhe  FCS 
include  fire,  explosion,  spalling,  structural  deformation, 
sparks,  and  fluid  leakage.  The  DWEA  process  evaluates  cause 
and  effect,  and  quantifies  the  likelihood  of  the  outcome. 
Secondary  damage  causes,  resulting  from  the  primary  damage 
mechanism  or  process,  are  included  in  the  evaluation  during 
this  analysis  phase.  Detailed  descriptions  of  the 
vulnerability  assessment  quantification  process  are 
presented  in  reference  1  and  in  MIL-STD-33 6- 1  [Ref.  2]. 

Failure  modes  can  be  categorized  and  qualitatively 
aligned  with  the  various  damage  causing  devices  or  events. 
Figure  4.9  correllates  the  example  FCS  failure  modes 
presented  in  Table  III  with  common  conventional  weapons 
damage  causing  agents. 

The  next  step  in  the  vulnerability  assessment 
process  is  the  actual  determination  of  the  critical 
components  for  the  selected  kill  level  assessed. 
Distinguishing  between  redundant  and  non-redundant  critical 
components  is  essential  in  this  phase  of  the  analysis.  To 
clarify  this  important  distinction,  a  set  of  components  is 
defined  to  be  redundant  if  the  loss  of  one  or  more  than  one, 
but  not  all  of  the  components,  does  not  result  in  the  loss 
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Failure/Damage  Modes 


Damage  Mechanisms 


Penetrator 

Continuous  Rod 

Fragment 

I 

Blast  | 

Fire 

Radiation 

Structural  Failure  Modes 
Area  Removal 
Overpressure 
Thermal  Degradation 
Penetration 

Electrical  Power  System 
Failure  Modes 

Line  Severance 

Grounding 

Avionics  System  Failure 
Modes 

Failure  to  Operate 

Degraded  Operations 

Hydraulic  Power  System 
Failure  Modes 

Loss  of  Fluid 

Loss  of  Pressure 

Jammed  Actuator 


Figure  4.9.  PCS  Failure  Bodes/Damage  Causing  Agents 

of  the  essential  function  these  components  perform.  If  this 
distinction  can  not  be  made,  the  components  are 
non-redundant.  As  an  example,  the  quadruple  control  signal 
paths  shown  for  the  example  FCS  form  a  multiply  redundant 
system  because  the  essential  function  of  providing  a 
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continuous  signal  path  is  maintained  even  though  or.®  or  more 
than  one  individual  path  may  be  rendered  discontinuous. 

Another  distinction  regarding  redundancy  must  be 
made.  The  term  "analytical  redundancy"  refers  to  a  method 
whereby  a  computational  algorithm  is  used  to  predict  an  end 
event  or  parameter.  Then  the  prediction  and  ?.  sensor 
derived  measurement  are  compared,  and  subsequent  actior(s) 
taken.  While  not  fitting  the  precise  definition  of 
redundancy,  the  computational  results  can  be  suitably  used 
in  lieu  of  the  sensor  output  in  certain  circumstances. 

The  determination  of  the  critical  components  and  the 
presentation  format  are  often  presented  in  a  "kill  tree"  or 
"kill  expression."  Referring  to  that  portion  of  the  kill 
tree  shown  in  Figure  4.10,  the  physical  relationship  tc  a 
free  is  apparent.  The  severance  of  sufficient  trunk 
segments  may  result  in  the  loss  of  the  tra9  and  in  the  case 
of  the  PCS,  the  loss  of  the  aircraft. 

Once  identified,  the  critical  components  may  be 
subject  to  various  engineering  redesigns  to  reduce  their 
contribution  to  the  vulnerability  of  the  aircraft. 
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v.  FCS  SURViy  ABILITY  DESIGN  GUIDELINES 

A.  GENERAL  PCS  DESIGN  PRINCIPLES 

General  design  principles  to  reduce  vulnerability  should 
be  exercised  to  the  fullest  extent  possible  throughout  the 
FCS  design  process.  Commencing  with  the  initial  design 
phases,  a  full  measure  of  consideration  must  be  given  to  the 
combat  survivability  of  the  flight  control  system.  Of 
course,  the  desire  for  increased  survivability  of  the  flight 
control  system  must  be  prudently  balanced  wi^h  the  other 
requirements  of  reliability,  maintainability,  accessibility, 
repairability,  and  safety.  Concurrently,  the  fullest 
measure  of  performance  must  be  achieved,  and  all  these 
factors  must  be  suitably  combined  within  stringent  cost  and 
weight  constraints.  In  the  end,  the  design  of  the  FCS  of 
military  combat  aircraft  must  include  suitable  protection 
from  the  primary  damage  causing  mechanisms  of  conventional 
threat  weapons  systems. 

The  six  survivability  enhancement  concepts  developed  in 
Chapter  II  (Table  II,  page  19)  provide  the  foundation  for 
the  general  FCS  design  principles.  In  general,  the  FCS 
design  principles  contain  provision  for  component  location 
and  shielding  to  reduce  potential  damage  risks;  elimination 
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(via  redesign)  of  high  risk,  single  point  failure 
components;  component  redundancy  with  adequate  separation  of 
redundant  components  to  maintain  the  essential  flight 
control  function;  and  the  incorporation  of  passive  and 
active  damage  suppression  devices  and  techniques  tc  minimize 
the  effects  of  incurred  damage.  A  flight  control  system 
design  that  includes  no  single  point  till  possibilities 
should  be  considered  a  design  goal. 

B.  SURVIVABILITY  DESIGN  GUIDELINES  FOR  FBW  FCS 

Specific  survivability  design  guidelines  applicable  tc 
the  individual  coiponents  and  subsystems  of  a  Fly-by-Wire 
Flight  Control  System  have  been  formulated  and  are  herein 
presented.  The  decision  to  incorporate  any  or  all  of  the 
design  guidelines  must  be  made  prudently  and  with  sound 
engineering  judgement. 

1.  Mechanical  System  Com ponents 

a)  Flight  Control  Surface  Panels 

Where  possible: 

•  Design  control  surface  panels  of  lightweight 
composite  materials  uAi-i-.  oyMm* 
strenath-to-weight 
redundant  load  carry 
ballistic  damage  tol 

•  Incorporate  smooth  surface  transitions  to 
redace  aircraft  signatures. 

•  Incorporate  multiple  surface  panels  on  each 
control  plane  tg  provide  peaundant  control 
surfaces  for  maximum  reconfigurability. 

•  Utilize  heat  resistant  surface  material  or 


patios  a 
mg  capab 
erance. 


integral 
ty  for  high 
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ablative  materials  to  retard  HEL  burnthrouah. 


b)  Hinges/Control  Linkages/Bearing  Assemblies 


where  possible: 


•  Design  components  to  be  jam-free. 

•  Utilize  self-aligning  beamings  (e.g. 
tri-pivot  bearings)  to  minimize  misalionment 
and  jamming  due  to  control  rod,  actuator  arm, 
or  control  surface  panel  deformation. 

e  Minimize  the  length  of  mechanical  control 
linkages  to  reduce  the  probability  of 
deformation  or  distortion. 

e  Otiliz?  ballistigally  daaaae  tolerant 

composite  materials  for  control  rods  and 
torque  tubes. 

e  Design  fairleads.  bellcranks,  and  idler 

assemblies  to  allow  a  measure  cf  functional 
performance  if  damaged. 

e  Install  primary  drive  motors,  control 

linkages,  interconnecting  devices,  and 
bearing  assemblies  in  close  proximity  to 
primary  structural  members  to  take  advantage 
of  the  shielding  afforded  by  the  primary 
structure. 

e  Ensure  that  that  aj.1  control  surfaces  are 

fitted  with  a  "trail  safe"  positioning  device 
to  prevent  hardover  cpnditions  in  the  event 
of  the  loss  of  the  drive  linkage. 


c)  Servcact uators 


Where  possible: 


•  Design  all  servoactuators  with  redundant 
power  sources  (e.g.  dual  cylinder  actuators). 

•  Design  actuator  pistons  of  fpapgible  or 
malleable  materials  to  minimize  the 
possibility  of  jamming. 

e  Design  actuator  barrel  assemblies  of  high 
strength  steel  for  high  ballistic  resistance 
(e.g.  Electro-Slag  Remelt  (ESR)  Steel)  . 

e  Design  the  actuator  outer-barrel  assemblies 
to  prevent  crack  propogation. 

e  Install  servoactuators  in  close  proximity  to 
gr^maj^ig  structural  members  for  maximum 

e  Install  rate  and,  position  feedback  linkages 
In  close  proximity  to  the  servoactuator 
assembly  for  maximum  shielding. 
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•  Utilize  integral  reservoir,  pump,  and 
electric  pcwer  packages  when  possible  (e.g. 
Integrated  Actuator  Packages  (IAP)). 

•  Incorporate  metallic  seals  in  place  of 
polymeric  seals  for  HEL  protection. 

•  Coat  actuator  housings  with  high  temperature 
resistant  or  ablative  materials  for  HEL 
burathrough  protection. 

•  Incorporate  high  strength  ablative  armor  in 
areas  of  critical  components. 

•  Incorporate  very  high  signal- to- noise  ratio 
servovalves  for  increased  EMI  tolerance. 


2.  Hydraulic  power  5 vstems 


a)  Fluid  Pressure  Generation  Subsystems 


Where  possible: 


•  Design  hydraulic  power  sources  to  be  sinqle 
or  double  redundant  (e.g.  separate  dual  or 
triple  hydraulic  power  sources)  . 

•  Physically  separate  hydraulic  power  sources 
as  much  as  possible  to  reduce  the  single  shot 
kill  probability  of  a  multiple  hydraulic 
system. 

•  Install  power  sources  in  close  proximity  to 
main  structural  members  to  provide  maximum 
shielding. 

•  Incorporate  high  temperature  resistant  or 
ablative  material  coatings  on  hydraulic  pump 
cases  to  increase  HEL  burnthrough  tolerance. 


b)  Fluid  Pressure  Distribution  Subsysteas 


Where  possible: 


e  Design  fluid  pressure  distribution  systems  of 
high  strength,  high  temperature  tolerant 
steel  lines. 


e 


i! 


corporate  single  or  double  redundant 
strlbuticn  lines  on  each  separate  fluid 
pressure  system. 


Incorporate  flow  sensors,  check  valves,  and 
switching  circuits  to  bypass  damaged  segments 
of  distribution  lines. 


e 


Incorporate  reservoir. 1 
to  Isolate  damaged  dl 
prevent  fluid  loss. 


evel  sensing 
stn'Dution  X 


, devices 
ines  to 


e  Install  distribution  lines  in  close  proximity 
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toj  main  structural  mexbsrs  to  maximize 
shielding. 

•  Utilize  very  high  pressure  (i.e.  4000-6000 
psi)  systems  to  reduce  presented  area. 

e  Utilize  high  temperature  resistant 

synthetic-Eased  hydraulic  fluid  to  reduce  or 
eliminate  fire  potential. 


3.  Electronic  S  ystem  Com poq ents 


a)  Flight  Control  lvionics  Components 


Where  possible: 


e  Design  all  primary  FBW  FCS  avionics 

components  with  multiple  redundancy  (e.a. 
multiple  LVDT  control  input  sensors  on  each 
control  axis  input,  ana  multiple  digital 
flight  control  computers!. 

e  Separate  rfdundant  avignics  comocnents  to 
minimize  single  shot  kill  probabilities. 

e  Design  all  avionics  component  cases  of  high 
strength  steel  for  maximum  ballistic 
resistance. 

e  Coat  all  avionics  component  cases  with  high 
temperature  resistant  or  ablative  materials 
for  maximum  HEL  burr.through  protection. 

e  Design  shock  mounts  for  internal  and  external 
components  to  withstand  vibration  and  weaoois 
induced  shock  loads. 


Install  avicnics  components  in  clos 

Sro* 1 mit y  to  primary  structural  me 
aximua  shielding. 


abers 


Incorporate  high  temperature  resistant  or 
ablative  armor  in  areas  surrounding  critical 
components. 


e  Design  electronic  components  with  suitable 
particulate,  vapor,  and  moisture  protection. 


b)  Electronic  Circuit  Design 


Where  possible: 


e  Design  input/output  circuits  of  very  high 
Signal-to-Noise  (S/N)  ratio  components  for 
maximum  EHI  protection. 

•  Minimize  capacitive  and  inductive 

cross-coupling  in  electronic  circuits. 

e  Incorporate  suitable  self-protect,  energy 
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dissipative  circuits  to  provide  lightning  and 
EMI/ EBP  protection  (e.g,  fusible  links, 
filters, or  spark-gap  devices)  . 

•  Provide  separate  and  redundant  analog 

channels,  with  separate  voting  logic,  as  a 
backup  to  the  digital  controller. 


c)  Signal  Transmission  Paths 


Where  possible: 


e  Design  single  or  double  redundant  signal 

paths  between  each  component  or  element  in  a 
signal  path. 

e  Provide  suitable  separation  between  redundant 
signal  transmission  lines  to  reduce  the 
single  shot  kill  probability. 

e  Route  sicnal  transmission  lines  in  close 

proxiaitf  to  primary  structural  members  for 
maximum  shielding. 

e  Provide  adequate  electromagnetic  shielding  to 
reduce  EMI. 

•  Otilize  high  temperature  resistant  wire 

covering  to  maximize  thermal/fire  protection 
and  to  minimize  BEL  burnthrough. 


d)  External  Sensors/ Inc illary  Subsystems 


where  possible: 


Design  multiple  redundant  external  sensors 
and  ancillary  subsystems  (e.g.  Air  Data 
Computers,  and  Angle  of  Attack  systems). 


Incorporate  high,  temperature 
ablative  material  armor  for 
ballistic  damage  tolerance. 


resistant 
thermal , 


or 

HEL  and 


Provide  separate,  redundant  motion  and  rate 
sensors  on  each  of  the  three  aircraft  axes. 


•  e  Mount  sensors  to  primary  structural  members 
for  maximum  shielding. 

•  Provide  analytically  redundant  sensory  .  , 
outputs  for  use  as  checks,  and  as  potential 
back-ups. 

e  Provide  adequate  built-in  test  circuits  with 
suitable  failure  warning  indications. 

e  Incorporate  separate, and  widely  displaced 
sensor  signal  transmission  paths. 


e)  Pilot  Control  Inputs 


Where  possible: 


e  Design  redundant  control  stick  and  rudder 
input  sensor  contacts. 

e  Utilize  sequenced  voting  logic  and  multiplex 
control  commands  to  each  of  the  central 
processing  units  of  the  fliaht  control 
computer  (s). 

e  Incorporate  separate  and  widely  displaced 
input  command  signal  transmission  paths. 


4.  Electrical  £owe£  System 


a)  Electrical  Poeer  Generation 


Where  possible: 


e  Design  electrical  power  generation  systems  to 
be  multiply  redundant  (e.g.  dual  generators, 
each  with  single  generator  capability) . 

e  Incorporate  multiply  redundant  AC/DC 
conversion  elements. 

e  Utilize  automatic/manual  or  manually 

activated  ran  air  turbine  emergency 
generators,  with  separate  AC/DC  conversion 
elements. 

e  Design  battery  back-up  systems. 


b)  Electrical  Power  Distribution 


Where  possible: 


e  Design  electrical  bus  distribution  systems 
for  "cross-over"  transient- free  operation. 

e  Incorporate  redundant  control  signal/power 
wiring  to  IAP  (if  utilized)  . 


5.  Environmental  control  system 


Where  possible: 


e  Design  separate  and  redundant  a  priori 
distributed  heating  and  cooling, 

fressurization,  and  volumetric  flow  systems 
o  critical  components  (e.g.  flight  control 
computer  (s) ) . 


Cncorporat  e 

ma  volume _ 

rating  condition 
.ure  occur)  . 


fail-safe  temperature, 
flow  sensors  (l.e.  a 
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VI.  SUHMAR?  AH  2.  R  ECOMMENDATIONS 


A.  SUMMARY 

In  summary,  it  has  been  the  author's  desire  :o  present 
in  a  single  document  a  clear-cut  set  of  guidelines  for  the 
development  of  aircraft  flight  control  systems  with  specific 
emphasis  on  increasing  the  combat  survivability  of  aircraft 
equipped  with  FBH  flight  control  systems.  The  material 
presented  and  the  guidelines  delineated  have  resulted  ir.  a 
document  that  is  as  complete  and  concise  as  any  single 
source  document  can  be  when  dealing  with  a  fast-paced, 
highly  complex  technical  subject.  This  document  should 
therefore  be  viewed  as  a  dynamic  tool  that  reflects  a 
continuous  chain  of  ongoing  thoughts  and  actions  to 
constantly  update  and  strengthen  the  quality,  capability  ar.d 
survivability  of  the  combat  systems  of  our  Armed  Forces. 

B.  RECOMMENDATIONS  FOR  FUTURE  ACTIONS 

Enhanced  survivability  alternatives  achievable  through 
digital  FBi  FCS  technology  should  be  investigated  fully. 
One  such  survivability  enhancement  alternative,  achievable 
through  digital  technology,  is  a  "self-healing", 
reconfigurable  aircraft  flight  control  system. 


Consider  for  a  moment  that  you  are  the  pilot  of  an 
aircraft  that  has  just  been  hit  by  enemy  grour.c-f  ire.  You 

feel  the  dull  thud  as  the  enemy  projectile  impacts  your 
aircraft's  aft  fuselage  area  and  now  you  sense  the  aircraft 
beginning  to  pitch  and  roll  without  command.  Your  survival 
instinct  tells  you  to  try  every  possible  combination  of 
stick  and  rudder  input  tc  counter  the  out-of-ccntrol 
aircraft  motion.  Nothing  seems  to  correct  the 

situation . your  final  thought  prior  to  ejecting  from 

your  stricken  craft  is  "if  only . " 

This  hypothetical  example  is  but  one  of  many  possible 
combat  related  incidents  that  might  be  resolved  in  another 
way  through  the  use  of  digital  technology.  Consider  the 
possibilities  afforded  by  digital  technology  in  regaining 
control  over  a  combat  damaged  aircraft  as  in  the 
aforementioned  example.  With  one  of  the  horizontal 
stabilators  gone,  an  alternate  combination  of  primary  and 
secondary  control  surfaces  might  be  commanded  by  the 
computer  to  return  the  aircraft  to  controlled  flight.  This 
proposed  survivability  enhancement  alternative  could  be 
obtained  with  minimal  additions  to  present  digital 
fly-by-wire  flight  control  configurations.  The  addition  of 


a  sensor  suite,  to  detect  and  identify  damaged  flight 
control  components,  and  a  computational  algorithm  to 
reconfigure  tte  aircraft  control  surfaces,  similar  in  nature 
to  that  used  in  artificially  intelligent  robot  devices,  are 
all  that  is  required.  Without  question,  successful! 
achievement  of  such  an  adventuresome  engineering  task  would 
require  a  dedicated  effort.  Outlined  in  the  following,  is  a 
plan  to  accomplish  such  a  project.  It  is  the  author's 
opinion  that  sincare  thought  and  consideration  should  be 
given  to  such  an  undertaking  in  the  near  term. 

A  plan  to  develop  an  artificially  intelligent, 
reconfigurable  flight  control  system  would  require  detailed 
engineering  analyses  of  the  following  areas: 

e  Computational  analysis,  and  wind  tunnel  determination 
of  aerodynamic  lift,  drag  and  moment  coefficients  on 
simulated  combat  damaged  aircraft.  models  (e.g.  model 
testing  of  missing,  jammed  or  trailing-free  control 
surfaces  in  single  and  multiple  combinations). 

e  Development  of  control  surface  reconfigurability 
alternatives. 

e  Development  of  suitable  sensors  to  detect  the  various 
levels  and  modes  of  combat  damage. 

e  Development  of  a  sequenced  logic  or  built-in  test 
routine  to  verify  flight  control  system  configuration 
and  status. 

It  is  the  author's  opinion  that  the  fundamental 
technology  and  expertise  are  present  within  the 
military-industrial  community  to  achieve  the  aforementioned 
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ative  at  low  technological 
that  tomorrow's  history  dee 


aircraft  survivability. 
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